{"id":"CVE-2026-89324","kind":"vulnerability","aliases":["CVE-2026-89324"],"related":[],"title":"Basel Post Types WordPress plugin: unauthenticated login as any user","description":"The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings.","summary":"Basel Post Types (XTemos) up to 1.18 has a coding error that makes it always use a hardcoded, publicly visible salt to verify social-login (Opauth) callbacks. An unauthenticated attacker can forge a callback for any existing account, admins included, and get a logged-in session, bypassing passwords and MFA. Fixed in 1.19.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"basel-post-types","fixed":["1.19"],"affected":"<= 1.18","ecosystem":"wordpress"}],"ecosystems":[],"tags":["basel-theme","package","plugin","self-hosted","woocommerce","wordpress","xtemos"],"not_affected_if":["no-woocommerce","patched-1.19","plugin-not-installed","social-login-not-configured","woocommerce-inactive"],"how_to_check":"In WP admin > Plugins (or wp plugin list), check whether basel-post-types is installed at version 1.18 or lower. Exposure needs WooCommerce active AND at least one Basel social login (Facebook, Google or VKontakte) configured with an app_id and app_secret in the theme options. Also grep access logs for requests with ?opauth.","fix":"Update Basel Post Types to 1.19 or later. If you can't update now, remove the app_id/app_secret for Facebook, Google and VKontakte social login in the Basel theme settings, or block requests containing the opauth parameter at the WAF (workaround from a third-party tracker, not tested). After updating, look for unknown admins, rotate passwords and sessions, and check access logs for opauth requests.","status":"open","published_at":"2026-11-10T22:21:14+00:00","first_seen_at":"2026-11-10T22:27:31+00:00","triaged_at":"2026-11-10T22:28:41+00:00","updated_at":"2026-11-10T22:29:18+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-10T22:28:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Basel Post Types WordPress plugin: unauthenticated login as any user","impact":"high","summary":"The Basel Post Types plugin for WordPress (all versions up to and including 1.18) falls back to a hardcoded, publicly visible salt when verifying social-login callbacks. An unauthenticated attacker can forge a login callback for any existing account, including administrators, and receive a valid session cookie.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","basel-theme","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any user, including administrators","analyst_note":"Confirm the fixed version of the Basel Post Types plugin on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-89324) or the vendor changelog; no fix is stated in the sources.","how_to_check":"- Check whether the Basel Post Types plugin is installed and its version is `1.18` or lower.\n- Check whether WooCommerce is active and whether Facebook, Google or VKontakte social login is configured with an app_id and app_secret in the Basel theme settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","woocommerce-inactive","social-login-not-configured"],"who_is_affected":"Sites running WordPress with the Basel theme's Post Types plugin at version 1.18 or lower, WooCommerce active, and at least one Basel social-login provider (Facebook, Google or VKontakte) configured. Sites without those settings are not exposed by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000802,"input_tokens":4893,"output_tokens":625,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version of the Basel Post Types plugin on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-89324) or the vendor changelog; no fix is stated in the sources.","search":"'-2026':12A,15A '-89324':13A,16A '1.18':38B,106C '1.19':86B '2nlbuibcszrvtnmdnxqdbwcoplwq91eatiz6o1o':156C 'account':70B,225C 'activ':257C 'address':227C 'admin':71B 'administr':215C 'alway':46B,145C 'app':277C,280C 'attack':62B,174C,206C 'auth':123C,127C,250C 'authent':97C,208C,235C,243C 'back':150C 'basel':1A,18A,22B,32B,88C,126C,262C 'basel-post-types':17A 'basel-them':21B 'bypass':80B,98C,228C 'call':120C 'callback':59B,66B,188C,219C 'caus':130C 'check':144C,238C 'code':41B,115C,165C 'comput':176C 'config':129C 'configur':273C 'constant':135C 'cooki':245C,251C 'custom':249C 'cve':11A,14A 'defin':119C 'email':226C 'endpoint':194C 'entir':181C 'error':42B,116C 'evalu':133C 'exist':69B,109C,211C 'exploit':252C 'facebook':267C 'factor':234C 'fail':146C 'fall':149C 'fix':84B 'forg':64B,186C,217C 'fulli':242C 'get':74B,128C 'googl':268C 'hardcod':49B,154C 'hook':193C 'host':28B 'id':278C 'includ':72B,105C,214C 'init':192C 'insid':125C 'known':172C,223C 'least':260C 'log':77B 'logged-in':76B 'login':7A,57B,199C,265C 'make':44B,142C,201C 'mfa':83B 'miss':113C 'missing-quot':112C 'multi':233C 'multi-factor':232C 'name':141C 'offlin':182C 'one':261C 'opauth':58B,179C,187C 'ownership':237C 'packag':24B 'password':81B,230C 'perman':148C 'php':131C 'plugin':5A,25B,91C 'possibl':203C 'post':2A,19A,33B,89C 'process':195C 'provid':266C 'public':50B,159C 'quot':114C 'rather':138C 'receiv':240C 'regist':197C 'requir':253C 'salt':52B,124C,155C,168C 'secret':281C 'secur':122C 'self':27B 'self-host':26B 'session':79B,244C 'set':248C,285C 'signatur':180C 'social':56B,264C 'social-login':55B,263C 'sourc':164C 'static':153C,170C 'submit':184C 'target':224C 'theme':23B,163C,284C 'tie':220C 'type':3A,34B,90C 'types':20A 'unauthent':6A,61B,191C,205C 'use':47B 'user':10A,213C 'valid':178C,276C 'valu':137C 'verif':231C 'verifi':54B 'version':101C 'via':246C 'visibl':51B,160C 'vkontakt':270C 'vulner':95C,108C 'wc':247C 'woocommerc':29B,254C 'wordpress':4A,30B,93C,212C 'xtemo':31B,35B","nicknames":[],"mitigations":[],"who_affected":"Sites running WordPress with the Basel theme's Post Types plugin at version 1.18 or lower, WooCommerce active, and at least one Basel social-login provider (Facebook, Google or VKontakte) configured. Sites without those settings are not exposed by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["baselposttypes"],"ptokens":["basel","post","types"],"labels":["baseltheme","critical","package","plugin","selfhosted","woocommerce","wordpress","xtemos"],"campaign_type":null,"search_a":"'-2026':12A,15A '-89324':13A,16A 'basel':1A,18A 'basel-post-types':17A 'cve':11A,14A 'login':7A 'plugin':5A 'post':2A,19A 'type':3A 'types':20A 'unauthent':6A 'user':10A 'wordpress':4A","search_b":"'1.18':38B '1.19':86B 'account':70B 'admin':71B 'alway':46B 'attack':62B 'basel':22B,32B 'basel-them':21B 'bypass':80B 'callback':59B,66B 'code':41B 'error':42B 'exist':69B 'fix':84B 'forg':64B 'get':74B 'hardcod':49B 'host':28B 'includ':72B 'log':77B 'logged-in':76B 'login':57B 'make':44B 'mfa':83B 'opauth':58B 'packag':24B 'password':81B 'plugin':25B 'post':33B 'public':50B 'salt':52B 'self':27B 'self-host':26B 'session':79B 'social':56B 'social-login':55B 'theme':23B 'type':34B 'unauthent':61B 'use':47B 'verifi':54B 'visibl':51B 'woocommerc':29B 'wordpress':30B 'xtemo':31B,35B","search_c":"'1.18':106C '2nlbuibcszrvtnmdnxqdbwcoplwq91eatiz6o1o':156C 'account':225C 'activ':257C 'address':227C 'administr':215C 'alway':145C 'app':277C,280C 'attack':174C,206C 'auth':123C,127C,250C 'authent':97C,208C,235C,243C 'back':150C 'basel':88C,126C,262C 'bypass':98C,228C 'call':120C 'callback':188C,219C 'caus':130C 'check':144C,238C 'code':115C,165C 'comput':176C 'config':129C 'configur':273C 'constant':135C 'cooki':245C,251C 'custom':249C 'defin':119C 'email':226C 'endpoint':194C 'entir':181C 'error':116C 'evalu':133C 'exist':109C,211C 'exploit':252C 'facebook':267C 'factor':234C 'fail':146C 'fall':149C 'forg':186C,217C 'fulli':242C 'get':128C 'googl':268C 'hardcod':154C 'hook':193C 'id':278C 'includ':105C,214C 'init':192C 'insid':125C 'known':172C,223C 'least':260C 'login':199C,265C 'make':142C,201C 'miss':113C 'missing-quot':112C 'multi':233C 'multi-factor':232C 'name':141C 'offlin':182C 'one':261C 'opauth':179C,187C 'ownership':237C 'password':230C 'perman':148C 'php':131C 'plugin':91C 'possibl':203C 'post':89C 'process':195C 'provid':266C 'public':159C 'quot':114C 'rather':138C 'receiv':240C 'regist':197C 'requir':253C 'salt':124C,155C,168C 'secret':281C 'secur':122C 'session':244C 'set':248C,285C 'signatur':180C 'social':264C 'social-login':263C 'sourc':164C 'static':153C,170C 'submit':184C 'target':224C 'theme':163C,284C 'tie':220C 'type':90C 'unauthent':191C,205C 'user':213C 'valid':178C,276C 'valu':137C 'verif':231C 'version':101C 'via':246C 'visibl':160C 'vkontakt':270C 'vulner':95C,108C 'wc':247C 'woocommerc':254C 'wordpress':93C,212C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:21:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89324","severity":null,"published_at":"2026-11-10T22:21:14+00:00","modified_at":"2026-11-10T22:21:14+00:00","first_seen_at":"2026-11-10T22:27:31+00:00","fetched_at":"2026-11-10T22:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89324:2983","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/basel-post-types/basel-post-types-118-unauthenticated-authentication-bypass-via-forged-opauth-callback-signature-with-hardcoded-fallback-salt","severity":null,"published_at":"2026-11-10T22:29:18+00:00","modified_at":"2026-11-10T22:29:18+00:00","first_seen_at":"2026-11-10T22:29:18+00:00","fetched_at":"2026-11-10T22:29:18+00:00","note":"Wordfence (CNA, researcher 0xwackydawg) and Patchstack: <=1.18 affected, fixed 1.19. Not verified: no vendor/maintainer page read. Patchstack page has a KEV banner but Wordfence-based trackers say not on KEV and no exploitation source found, so exploited left false. No PoC found.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/basel-post-types/basel-post-types-118-unauthenticated-authentication-bypass-via-forged-opauth-callback-signature-with-hardcoded-fallback-salt","https://patchstack.com/database/wordpress/plugin/basel-post-types/vulnerability/wordpress-basel-post-types-plugin-1-18-unauthenticated-authentication-bypass-vulnerability"]}],"documents":[{"id":119648,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/basel-post-types/basel-post-types-118-unauthenticated-authentication-bypass-via-forged-opauth-callback-signature-with-hardcoded-fallback-salt","title":"Wordfence: Basel Post Types <= 1.18 auth bypass","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119649,"url":"https://patchstack.com/database/wordpress/plugin/basel-post-types/vulnerability/wordpress-basel-post-types-plugin-1-18-unauthenticated-authentication-bypass-vulnerability","title":"Patchstack: Basel Post Types <= 1.18","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}